ensp——ACL实验

一丶搭建实验环境及基本配置

AR1的IP配置
[AR1]interface g0/0/0
[AR1-GigabitEthernet0/0/0]ip address 192.168.1.1 24
[AR1-GigabitEthernet0/0/0]q
[AR1]interface g0/0/1
[AR1-GigabitEthernet0/0/1]ip address 12.1.1.1 24
AR2的IP配置
[AR2]interface g0/0/0
[AR2-GigabitEthernet0/0/0]ip address 12.1.1.2 24
[AR2-GigabitEthernet0/0/0]q
[AR2]interface g0/0/1
[AR2-GigabitEthernet0/0/1]ip address 192.168.2.1 24
[AR2-GigabitEthernet0/0/1]q
[AR2]interface g0/0/2
[AR2-GigabitEthernet0/0/2]ip address 23.1.1.2 24
AR3的IP配置
[AR3]interface g0/0/0
[AR3-GigabitEthernet0/0/0]ip address 23.1.1.3 24
[AR3-GigabitEthernet0/0/0]
[AR3]int
[AR3]interface g0/0/1
[AR3-GigabitEthernet0/0/1]ip address 192.168.3.1 24
PC1

PC2
PC3
二丶启用RIP协议，在PC端查看是否全网通
AR1
[AR1]rip 1
[AR1-rip-1]version 2
[AR1-rip-1]network 12.0.0.0
[AR1-rip-1]network 192.168.1.0
AR2
[AR2]rip 1
[AR2-rip-1]version 2
[AR2-rip-1]network 12.0.0.0
[AR2-rip-1]network 192.168.2.0
[AR2-rip-1]network 23.0.0.0
AR3
[AR3]rip 1
[AR3-rip-1]version 2
[AR3-rip-1]network 23.0.0.0
[AR3-rip-1]network 192.168.3.0
在PC去Ping其他主机的IP，出现下图则表明已全网通

三丶通过ACL的配置使得PC1和PC2可以正常通信，但PC1不能和PC3通信
基本acl：在靠近目标的端口
方法一：在AR3的g0/0/1接口拒绝PC1的访问
[AR3]acl 2000
[AR3-acl-basic-2000]rule deny source 192.168.1.2 0
[AR3-acl-basic-2000]q
[AR3]interface g0/0/1//在该接口调用
[AR3-GigabitEthernet0/0/1]traffic-filter outbound acl 2000
[AR3-GigabitEthernet0/0/1]q
验证结果：
方法二：在AR3上只允许PC2拒绝PC3
若先使用的方法一则需删掉原来的配置，删掉后仍然全网通
[AR3]undo acl 2000
[AR3]acl 2000
[AR3-acl-basic-2000]rule permit source 192.168.2.2 0
[AR3-acl-basic-2000]rule deny source any
方法一已经调用过此处可不必调用
‘’’
[AR3]interface g0/0/1//在该接口调用
[AR3-GigabitEthernet0/0/1]traffic-filter outbound acl 2000
[AR3-GigabitEthernet0/0/1]q
‘’’
****此时结果同方法一的结果
四丶AR1远程登录到AR3，但两者不能ping通，PC1，PC2仍能正常通信
高级acl
[AR3]undo acl 2000 //删掉原来的配置
在AR3设置远程登录
[AR3]user-interface vty 0 4
[AR3-ui-vty0-4]authentication-mode password
Please configure the login password (maximum length 16):huawei
AR1远程登录
telnet 192.168.3.1 //此处也可换为23.1.1.3

<1>1-3被拒绝ping，但可以远程登录
[AR2]acl 3000
[AR2-acl-adv-3000]rule deny icmp source 12.1.1.1 0 destination 23.1.1.3 0
[AR2-acl-adv-3000]q
[AR2]interface g0/0/0
[AR2-GigabitEthernet0/0/0]traffic-filter inbound acl 3000
[AR2-GigabitEthernet0/0/0]q

<2>1-3可以ping通，但不可以远程登录
[AR2]undo acl 3000 //删除之前的配置
[AR2]acl 3000
[AR2-acl-adv-3000]rule deny tcp source 12.1.1.1 0 destination-port eq 23
[AR2-acl-adv-3000]q
由于<1>中已经调用此处可不必调用
‘’’
[AR2]interface g0/0/0
[AR2-GigabitEthernet0/0/0]traffic-filter inbound acl 3000
[AR2-GigabitEthernet0/0/0]q
‘’’
结果正好与<1>相反